8b0c4556e30ab51385a4d4cb915d94f61a74fb57a235bac0ef8929eedcbcb300

Analysis

max time kernel
485s
max time network
488s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/12/2024, 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SteamtoolsSetup.exe
Size

931KB
MD5

437a78852ca72c066ab69826eaec8fda
SHA1

067f013edc49612d2ad97be0ca19bd5aba144f10
SHA256

8b0c4556e30ab51385a4d4cb915d94f61a74fb57a235bac0ef8929eedcbcb300
SHA512

945495fe067a518387a9a6fad028c29f9a23cfc2b98838c061b9e53320d91662089c532a44cb4c2dac1504c8a3adcae03c66ecdaf67919f898f3ca2e91ad304e
SSDEEP

24576:5muyG01IeGKHK8LKr7r0sUpPFXzcuTqLbTB1Kay2y/Cp5h1T4q:1KHP07r0sUr7TqLbTB1KayEpH1T4

Score

8^/10

steam defense_evasion discovery persistence phishing

Malware Config

Signatures

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SteamtoolsSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe

Executes dropped EXE 52 IoCs

pid	Process
5836	SteamSetup.exe
5964	steamservice.exe
3648	steam.exe
13976	steam.exe
14140	steamwebhelper.exe
14188	steamwebhelper.exe
2568	steamwebhelper.exe
15080	steamwebhelper.exe
5576	gldriverquery64.exe
2244	steamwebhelper.exe
6100	steamwebhelper.exe
2260	gldriverquery.exe
7008	vulkandriverquery64.exe
6916	vulkandriverquery.exe
8008	Steamtools.exe
5704	steam.exe
14972	steamwebhelper.exe
15008	steamwebhelper.exe
8436	steamwebhelper.exe
8560	steamwebhelper.exe
4348	gldriverquery64.exe
7036	steamwebhelper.exe
10592	steamwebhelper.exe
10244	gldriverquery.exe
5688	vulkandriverquery64.exe
7868	vulkandriverquery.exe
10428	steamwebhelper.exe
4596	steamwebhelper.exe
4372	steamwebhelper.exe
9088	steamwebhelper.exe
3620	steamwebhelper.exe
10480	steamwebhelper.exe
10492	steamwebhelper.exe
11336	steamwebhelper.exe
11320	steamwebhelper.exe
11204	steamwebhelper.exe
11252	steamwebhelper.exe
12100	steamwebhelper.exe
12088	steamwebhelper.exe
13060	steamwebhelper.exe
13320	steamerrorreporter64.exe
13760	steam.exe
13884	steamwebhelper.exe
13920	steamwebhelper.exe
14112	steamwebhelper.exe
15096	steamwebhelper.exe
4456	gldriverquery64.exe
2572	steamwebhelper.exe
7004	steamwebhelper.exe
6580	gldriverquery.exe
6028	vulkandriverquery64.exe
1048	vulkandriverquery.exe

Loads dropped DLL 64 IoCs

pid	Process
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14188	steamwebhelper.exe
14188	steamwebhelper.exe
14188	steamwebhelper.exe
13976	steam.exe
2568	steamwebhelper.exe
2568	steamwebhelper.exe
2568	steamwebhelper.exe
2568	steamwebhelper.exe
2568	steamwebhelper.exe
2568	steamwebhelper.exe
2568	steamwebhelper.exe
2568	steamwebhelper.exe
13976	steam.exe
2568	steamwebhelper.exe
15080	steamwebhelper.exe
15080	steamwebhelper.exe
15080	steamwebhelper.exe
13976	steam.exe
2244	steamwebhelper.exe
2244	steamwebhelper.exe
2244	steamwebhelper.exe
6100	steamwebhelper.exe
6100	steamwebhelper.exe
6100	steamwebhelper.exe
6100	steamwebhelper.exe
5704	steam.exe
5704	steam.exe
5704	steam.exe
5704	steam.exe
5704	steam.exe
5704	steam.exe
5704	steam.exe
5704	steam.exe
5704	steam.exe
5704	steam.exe
5704	steam.exe
5704	steam.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Detected potential entity reuse from brand STEAM.
phishing steam

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sd_ltrackpad.svg_	steam.exe
File created	C:\program files (x86)\steam\appcache\librarycache\931180_header.jpg	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_035_magic_0311.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\overlay_korean.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_lt_soft_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_outlined_button_a_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_035_magic_0310.png_	steam.exe
File created	C:\program files (x86)\steam\appcache\httpcache\17\179fd233294aeca72980ca4a121ed326430114b0_da39a3ee5e6b4b0d3255bfef95601890afd80709	steam.exe
File created	C:\program files (x86)\steam\appcache\librarycache\212070_library_hero.jpg	steam.exe
File created	C:\program files (x86)\steam\appcache\librarycache\236390_library_header.jpg	steam.exe
File created	C:\program files (x86)\steam\appcache\librarycache\294420_library_hero_blur.jpg	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\flag_inactive_right_hover.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_dpad_click.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_dpad_up_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sc_rt_soft_lg.png_	steam.exe
File created	C:\program files (x86)\steam\appcache\librarycache\493840_library_hero_blur.jpg	steam.exe
File created	C:\program files (x86)\steam\appcache\httpcache\e5\e5025eff0abad30fb165bb596712b7a3b4772bfb_da39a3ee5e6b4b0d3255bfef95601890afd80709	steam.exe
File created	C:\program files (x86)\steam\appcache\httpcache\78\7837ad1769a58d3eb78623bb1c20404399741303_da39a3ee5e6b4b0d3255bfef95601890afd80709	steam.exe
File created	C:\program files (x86)\steam\appcache\librarycache\444640_icon.jpg	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_035_magic_0312.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0324.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0314.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\flag_right.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps4_r2.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_rt_soft.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0424.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\bin\fossilize-replay64.exe_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_lstick_right_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_outlined_button_y_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\joyconpair_right_sr_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\movelibrarydialog.res_	steam.exe
File created	C:\program files (x86)\steam\appcache\librarycache\440_library_600x900.jpg	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\SystemRequirementsDialog.res_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\[email protected]_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\friends\trackerui_finnish.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steambootstrapper_swedish.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_dpad_down_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_color_outlined_button_y.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\CDKeyReceipt.html_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad_l_click_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_color_button_a_sm.png_	steam.exe
File created	C:\program files (x86)\steam\appcache\librarycache\386180_library_600x900.jpg	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\workshop_minibanner.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_r4_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sc_touchpad_swipe_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steambootstrapper_french.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\rampUp_2.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_ltrackpad_ring.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\localization\steampops_vietnamese-json.js_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps_color_button_square_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_button_y_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\sounds\deck_ui_hide_modal.wav_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0070.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_rtrackpad_ring.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\friends\trackerui_ukrainian.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_rstick_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_trackpad_l_left.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_trackpad_right_md.png_	steam.exe
File opened for modification	C:\program files (x86)\steam\dumps\settings.dat	steamwebhelper.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_r_left_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_030_inv_0322.png_	steam.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vulkandriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gldriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gldriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vulkandriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gldriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vulkandriverquery.exe

Checks processor information in registry 2 TTPs 29 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
7912	taskkill.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\program files (x86)\\steam\\steam.exe\" -- \"%1\""	steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink\ = "URL:steamlink protocol"	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\URL Protocol	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\Shell	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\program files (x86)\\steam\\steam.exe\" -- \"%1\""	steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink\URL Protocol	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\DefaultIcon	steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\Shell\Open\Command	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink\Shell\Open\Command	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink\DefaultIcon	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\Shell\Open	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\ = "URL:steam protocol"	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\program files (x86)\\steam\\steam.exe\" -- \"%1\""	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\program files (x86)\\steam\\steam.exe\" -- \"%1\""	steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\steamlink\Shell	steamservice.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	steam.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
8008	Steamtools.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
5836	SteamSetup.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe
13976	steam.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
13976	steam.exe
8008	Steamtools.exe
5704	steam.exe
13760	steam.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2952	firefox.exe
Token: SeDebugPrivilege	2952	firefox.exe
Token: SeDebugPrivilege	2952	firefox.exe
Token: SeDebugPrivilege	2952	firefox.exe
Token: SeDebugPrivilege	2952	firefox.exe
Token: SeDebugPrivilege	5836	SteamSetup.exe
Token: SeDebugPrivilege	5836	SteamSetup.exe
Token: SeDebugPrivilege	5836	SteamSetup.exe
Token: SeDebugPrivilege	5836	SteamSetup.exe
Token: SeDebugPrivilege	5836	SteamSetup.exe
Token: SeSecurityPrivilege	5964	steamservice.exe
Token: SeSecurityPrivilege	5964	steamservice.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeDebugPrivilege	7912	taskkill.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14140	steamwebhelper.exe
Token: SeShutdownPrivilege	14140	steamwebhelper.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe
14140	steamwebhelper.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
5836	SteamSetup.exe
5964	steamservice.exe
13976	steam.exe
8008	Steamtools.exe
8008	Steamtools.exe
8008	Steamtools.exe
8008	Steamtools.exe
5704	steam.exe
8008	Steamtools.exe
13760	steam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2952	2792	firefox.exe	88
PID 2792 wrote to memory of 2952	2792	firefox.exe	88
PID 2792 wrote to memory of 2952	2792	firefox.exe	88
PID 2792 wrote to memory of 2952	2792	firefox.exe	88
PID 2792 wrote to memory of 2952	2792	firefox.exe	88
PID 2792 wrote to memory of 2952	2792	firefox.exe	88
PID 2792 wrote to memory of 2952	2792	firefox.exe	88
PID 2792 wrote to memory of 2952	2792	firefox.exe	88
PID 2792 wrote to memory of 2952	2792	firefox.exe	88
PID 2792 wrote to memory of 2952	2792	firefox.exe	88
PID 2792 wrote to memory of 2952	2792	firefox.exe	88
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 4224	2952	firefox.exe	89
PID 2952 wrote to memory of 1408	2952	firefox.exe	90
PID 2952 wrote to memory of 1408	2952	firefox.exe	90
PID 2952 wrote to memory of 1408	2952	firefox.exe	90
PID 2952 wrote to memory of 1408	2952	firefox.exe	90
PID 2952 wrote to memory of 1408	2952	firefox.exe	90
PID 2952 wrote to memory of 1408	2952	firefox.exe	90
PID 2952 wrote to memory of 1408	2952	firefox.exe	90
PID 2952 wrote to memory of 1408	2952	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SteamtoolsSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SteamtoolsSetup.exe"
1⤵
PID:4312

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ddc8fd7-74ee-4b1a-ad3e-64b4213ecce6} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" gpu
    3⤵
    PID:4224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10ed9e6d-d80e-43b2-a263-11e12b8674bd} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" socket
    3⤵
    - Checks processor information in registry
    PID:1408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3400 -childID 1 -isForBrowser -prefsHandle 3416 -prefMapHandle 3236 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c096b4e9-2631-4f49-a2d1-10a40ebe9ba1} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" tab
    3⤵
    PID:3940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4016 -childID 2 -isForBrowser -prefsHandle 4008 -prefMapHandle 4004 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48135c7b-1214-4498-9ff1-ba28a3623327} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" tab
    3⤵
    PID:3744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4820 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4884 -prefMapHandle 4648 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b21791ca-279a-4033-b8fc-1a50438b04d1} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" utility
    3⤵
    - Checks processor information in registry
    PID:1380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5380 -childID 3 -isForBrowser -prefsHandle 5392 -prefMapHandle 5388 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc931bbb-fd96-4446-9b91-d9e8d8628b78} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" tab
    3⤵
    PID:4264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 4 -isForBrowser -prefsHandle 5620 -prefMapHandle 5616 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2fd309e-1cbd-4825-b905-6072f12d3d79} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" tab
    3⤵
    PID:3140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 5 -isForBrowser -prefsHandle 5512 -prefMapHandle 5516 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfdf3746-b565-4677-bab7-8d9f1107d575} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" tab
    3⤵
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6148 -childID 6 -isForBrowser -prefsHandle 5380 -prefMapHandle 6052 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b63344a5-0547-41c4-8ee0-e4b00c41f240} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" tab
    3⤵
    PID:5768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6620 -childID 7 -isForBrowser -prefsHandle 6756 -prefMapHandle 6596 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b3d784f-4fb2-4b6f-8e5d-7b7f57022927} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" tab
    3⤵
    PID:3732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 8 -isForBrowser -prefsHandle 6992 -prefMapHandle 5996 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bbb895a-8147-44ac-8cd3-86bb22f7e3e0} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" tab
    3⤵
    PID:3912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6536 -parentBuildID 20240401114208 -prefsHandle 5456 -prefMapHandle 6992 -prefsLen 30532 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d26d1060-3d83-44c1-8dfc-65afa6137fdf} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" rdd
    3⤵
    PID:2132
- - C:\Users\Admin\Downloads\SteamSetup.exe
    "C:\Users\Admin\Downloads\SteamSetup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5836
  - - C:\Program Files (x86)\Steam\bin\steamservice.exe
      "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1016

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
PID:3648
- C:\Program Files (x86)\Steam\steam.exe
  "C:\Program Files (x86)\Steam\steam.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:13976
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=13976" "-buildid=1733265492" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:14140
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1733265492 --initial-client-data=0x280,0x284,0x288,0x278,0x28c,0x7ffb6ae4af00,0x7ffb6ae4af0c,0x7ffb6ae4af18
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:14188
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1596,i,10861857333485091864,14401731416482901094,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1600 --mojo-platform-channel-handle=1588 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2568
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2264,i,10861857333485091864,14401731416482901094,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2268 --mojo-platform-channel-handle=2260 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:15080
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2712,i,10861857333485091864,14401731416482901094,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2716 --mojo-platform-channel-handle=2708 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2244
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,10861857333485091864,14401731416482901094,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3080 --mojo-platform-channel-handle=3068 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:6100
- - C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
    .\bin\gldriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:5576
- - C:\Program Files (x86)\Steam\bin\gldriverquery.exe
    .\bin\gldriverquery.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2260
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
    .\bin\vulkandriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:7008
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
    .\bin\vulkandriverquery.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x304
1⤵
PID:3304

C:\Users\Admin\AppData\Local\Temp\SteamtoolsSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SteamtoolsSetup.exe"
1⤵
- Checks computer location settings
PID:2456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /IM Steamtools.exe /F >nul 2>&1
  2⤵
  PID:7892
- - C:\Windows\system32\taskkill.exe
    taskkill /IM Steamtools.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7912
- C:\Program Files (x86)\Steam\config\stUI\Steamtools.exe
  "C:\Program Files (x86)\Steam\config\stUI\Steamtools.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:8008
- - C:\program files (x86)\steam\steam.exe
    "C:\program files (x86)\steam\steam.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5704
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=5704" "-buildid=1733265492" "-steamid=0" "-logdir=C:\program files (x86)\steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\program files (x86)\steam\clientui" "-steampath=C:\program files (x86)\steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Checks processor information in registry
      PID:14972
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\program files (x86)\steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1733265492 --initial-client-data=0x29c,0x2a0,0x2a4,0x298,0x2a8,0x7ffb6ae4af00,0x7ffb6ae4af0c,0x7ffb6ae4af18
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:15008
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1616,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1620 --mojo-platform-channel-handle=1608 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:8436
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2392,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2396 --mojo-platform-channel-handle=2388 /prefetch:3
        5⤵
        Executes dropped EXE
        
        PID:8560
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2840,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2844 --mojo-platform-channel-handle=2832 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:7036
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3212 --mojo-platform-channel-handle=3204 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:10592
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3632,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3888 --mojo-platform-channel-handle=3604 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:10428
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4064,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4072 --mojo-platform-channel-handle=4076 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4596
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4520,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4496 --mojo-platform-channel-handle=4536 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4372
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=4676,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4132 --mojo-platform-channel-handle=4472 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:9088
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=4212,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4124 --mojo-platform-channel-handle=4112 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:3620
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4748,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4072 --mojo-platform-channel-handle=4752 /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:10492
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4768,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4772 --mojo-platform-channel-handle=4764 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:10480
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4592,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4608 --mojo-platform-channel-handle=4560 /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:11320
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4580,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4040 --mojo-platform-channel-handle=4596 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:11336
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4568,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4604 --mojo-platform-channel-handle=4620 /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:11252
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4964,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4572 --mojo-platform-channel-handle=5192 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:11204
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4208,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4548 --mojo-platform-channel-handle=4900 /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:12088
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4544,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4604 --mojo-platform-channel-handle=5056 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:12100
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5048,i,13214816896064975742,10177994340882370887,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4784 --mojo-platform-channel-handle=4772 /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:13060
    - - C:\Program Files (x86)\Steam\steamerrorreporter64.exe
        
        C:\Program Files (x86)\Steam\steamerrorreporter64.exe -pid=14972
        5⤵
        Executes dropped EXE
        
        PID:13320
  - - C:\program files (x86)\steam\bin\gldriverquery64.exe
      .\bin\gldriverquery64.exe
      4⤵
      Executes dropped EXE
      PID:4348
  - - C:\program files (x86)\steam\bin\gldriverquery.exe
      .\bin\gldriverquery.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:10244
  - - C:\program files (x86)\steam\bin\vulkandriverquery64.exe
      .\bin\vulkandriverquery64.exe
      4⤵
      Executes dropped EXE
      PID:5688
  - - C:\program files (x86)\steam\bin\vulkandriverquery.exe
      .\bin\vulkandriverquery.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:7868
  - - C:\program files (x86)\steam\steam.exe
      "C:\program files (x86)\steam\steam.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:13760
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=13760" "-buildid=1733265492" "-steamid=0" "-logdir=C:\program files (x86)\steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\program files (x86)\steam\clientui" "-steampath=C:\program files (x86)\steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Checks processor information in registry
        
        PID:13884
      - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\program files (x86)\steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1733265492 --initial-client-data=0x29c,0x2a0,0x2a4,0x298,0x2a8,0x7ffb6ae4af00,0x7ffb6ae4af0c,0x7ffb6ae4af18
        6⤵
        Executes dropped EXE
        
        PID:13920
      - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1616,i,4812706122450919632,16156815690496671625,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1620 --mojo-platform-channel-handle=1608 /prefetch:2
        6⤵
        Executes dropped EXE
        
        PID:14112
      - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2256,i,4812706122450919632,16156815690496671625,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2260 --mojo-platform-channel-handle=2252 /prefetch:3
        6⤵
        Executes dropped EXE
        
        PID:15096
      - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2916,i,4812706122450919632,16156815690496671625,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2920 --mojo-platform-channel-handle=2912 /prefetch:8
        6⤵
        Executes dropped EXE
        
        PID:2572
      - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,4812706122450919632,16156815690496671625,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3196 --mojo-platform-channel-handle=3188 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:7004
    - - C:\program files (x86)\steam\bin\gldriverquery64.exe
        
        .\bin\gldriverquery64.exe
        5⤵
        Executes dropped EXE
        
        PID:4456
    - - C:\program files (x86)\steam\bin\gldriverquery.exe
        
        .\bin\gldriverquery.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6580
    - - C:\program files (x86)\steam\bin\vulkandriverquery64.exe
        
        .\bin\vulkandriverquery64.exe
        5⤵
        Executes dropped EXE
        
        PID:6028
    - - C:\program files (x86)\steam\bin\vulkandriverquery.exe
        
        .\bin\vulkandriverquery.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Steam\Steam.exe

Filesize
4.2MB

MD5
33bcb1c8975a4063a134a72803e0ca16

SHA1
ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65

SHA256
12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1

SHA512
13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

Download Submit
C:\Program Files (x86)\Steam\aom.dll

Filesize
7.1MB

MD5
d764264518e77cc546a5876c3bcebad4

SHA1
ea17d45b396fa193a851bfd345e2b2c20ad60e12

SHA256
e78492de0ab575add50b925bfd44216d224d09904a9b14c17087a92fdcbc15cd

SHA512
7cf132ea5254a55c08186ffcf5e47360ef5ddd57d03d7051171f6753b22e3925304d183c2037bfd320ad56c08e079f9b2c4640db8cb3dbd38ff500c7a39e997f

Download Submit
C:\Program Files (x86)\Steam\bin\SteamService.exe

Filesize
2.5MB

MD5
ba0ea9249da4ab8f62432617489ae5a6

SHA1
d8873c5dcb6e128c39cf0c423b502821343659a7

SHA256
ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d

SHA512
52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b

Download Submit
C:\Program Files (x86)\Steam\bin\audio.dll

Filesize
183KB

MD5
63203b19d445107d45ad60e15c4dbf51

SHA1
0437eda1fa6acaea24dda0825982c4ed700205b8

SHA256
a02ebac018b3477e6d5c4f68672fb7bcfbcc19caff690447391eb5909067b6ac

SHA512
d13280fe2ff018bf324c58598cd40d7d290e0c3358d63ab1fc3dfc8f3cd3365e92cb971f808daf85f1e8e5cd5661a27a74e56b7e4b939842db6342a8a0eaacad

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\chrome_elf.dll

Filesize
1.3MB

MD5
0eeaea918f3603e5ff2bd955f9f0c0aa

SHA1
0404b3bd9324703a46d5f3e3d2471386951feee5

SHA256
3f49301338c33f40b3ca8528eaa40e9f7fc8f7952f59b8f4281ca5d3e1ddf25f

SHA512
0fa19dc76d28d449f2e96e4faf3ce57e7ad811b8888de2140152ba0355cc8d6ed787371ff90fbac0d1b0c900fcb1fd4ef1f45c8114b0f10ca5f97f05146ef945

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\d3dcompiler_47.dll

Filesize
4.7MB

MD5
c6c2fc1388f3d04c170417d733fcd52b

SHA1
fe74b15be9b5227cc3597471e4df0913b5acefb2

SHA256
8b575383ebaf641d7e29b85d010af232dfe008be800ec936d5b4d0c19ae47ca4

SHA512
e155cc3d0e1f1b2ad8992cc907c36923bcbce17cb53e731ea3d02e529bef11324219a86e461fbb6d0b9247d1638d14d558e083fdcdd2c6ef301160d00bc88fe7

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\dbgcore.dll

Filesize
211KB

MD5
e6bcc49fe10142480344ecf6f78f17f7

SHA1
fc8d3f1e85b2dc6934cbd4d2fb9250792eb991aa

SHA256
b4675afaff6fe2d9253a16e4bbeb376b0b4fdee087ce71419e11b78ca211ef2a

SHA512
9152d99fc8ab1a4a7f6d2f73fd3cde17c741620b42e7011fd4534315ce18ac12517846ee21f12327d6343e5c4f4a86d01e4b40a1ef1ffc803e4969f3629dfd36

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\dxcompiler.dll

Filesize
21.0MB

MD5
e3f531e75b63bcb3bbf8da1d5df8aa43

SHA1
9574e78e7ae36944687083923a9d09e15c593ebb

SHA256
fdf572f1b15982d6b6b0083026fad4a0352a5c99efe97f182e8ba72d682de610

SHA512
424fdc9da6518d5f269cf635aa66524161fa31771a8bc6dd91add826cdde9f0bed7879b259419c33a1d00155546d1a68aadc6a9acff32290b9543767dd04a9d3

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\dxil.dll

Filesize
1.4MB

MD5
8167a6e8cc35988d02938cfa3ae1c0dd

SHA1
1bb1b83c7dc957e074320b033aab83f015eb777b

SHA256
bf97fcfc4f107a98932ac6f9169d9fb936dbedaac5cc06005a87fae436b577cb

SHA512
bcb9e8fbc79c108ec525ec2a1d5d8bba7c2a295e39eabf48d8eba2095eeffcbb2a2b8f66219cda9786bae6a1fa6ff27f054f97ffa002957d16f2969018e62606

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\eventlog_provider.dll

Filesize
17KB

MD5
a73d3ef675f9a0840a4f08e71066f5b2

SHA1
bbe14a1ea609bf288a54b0299c74f8f8f66a1bab

SHA256
7359a29c5c6201c815ab3e58487f0f95617f766bd6cb2eda182dc8da5e058c8d

SHA512
30b34a9c91fd08f6f689271fc486e5a2d7f984f6bb0717aa68d4d1d8b58e3e18059cf24ff679893249f1b40d2514994a0b36143425e6dce02f1aee3751810958

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\libEGL.dll

Filesize
472KB

MD5
9a5749b691b3c345f4e313b06b127a94

SHA1
bad7c65d67e3d548e9ae757a7aa5bd5a079fd3b8

SHA256
682acd1cfa7390386d8cd8c8267e365ac0abbef1788587f8150b99e424e9b0e9

SHA512
4de9d18b4245105ea22520ee6b27cf7cb8f5ca0777408eb9993f4f97d1820582c6e3694e0142cdb373e8406e1117f568ae4f314b3027a0791d8866bd191b545f

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\libGLESv2.dll

Filesize
7.7MB

MD5
35f34351979e8aca52c09d674dde7345

SHA1
3fad78f021c78f8368823d6a26b81999d8b10ac9

SHA256
cdcd26fc7fc0c79b03726f66c235634f1a58de0ea2418281c157b9f05151f2ef

SHA512
5a1941c673d9fb101189e65bf3ca7d016baf0b75fd29ee2bbcb30270d27717c292b4c8ed08a646c022a87d94434cd29ef2719f8fc4388ef2be00b58f036f43d4

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\msdia140.dll

Filesize
2.2MB

MD5
4aa30cedcc1b685865f518c70aa50bc7

SHA1
d457dd8fc0fdb1cc15879f7f09f2ffdcfbef8cba

SHA256
0b07dd35f63e959e25627ee7f439440bf59ce27b68eb2512eb68b8933cf734f2

SHA512
bef70d17dd68cd9060d1e4db9fe9a36ffccad5f2540a1e9587385d48484d021abc2e493397bc4284d40a44379be3c576a8244603388f20cfcd9e95d64f70adeb

Download Submit
C:\Program Files (x86)\Steam\bin\diversion.dll

Filesize
19.0MB

MD5
e56d82d03ece0ebb69014d8ffa1b7cba

SHA1
989d7514f85e32a35667b92e5afc4a115c4e871a

SHA256
ac07790d0bd74b0580ca4cbca6817b90175d537bcbd1d395426d7bbf68ce70ea

SHA512
15f99bf471ac86cb06d1d576cc16afa473508400c1d436a567a51200c2281d9f5d4e948adafd23f38af9bfa1d99235599452536a86cbdc5fa440ecdec4cc4be1

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
1KB

MD5
6e6a2b18264504cc084caa3ad0bfc6ae

SHA1
b177d719bd3c1bc547d5c97937a584b8b7d57196

SHA256
f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53

SHA512
74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
11KB

MD5
9734089749d6f3776b3e502457ffcae5

SHA1
7b3b825c6b02bc50524608e0c3f33e41cd522626

SHA256
55e2a4f12309b967b45280112965834cb4aad47554205b63f9b3514cadd3d720

SHA512
e63ef444dd3e4123cf5bd735f4316216c6eef0b352eaa1d3dd0bc6685fa61e93cfa0606e9673c57cceb9254ac3ac77c42546b4a130c121136648d383c86de02f

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
12KB

MD5
f88cf7d3b0fc5018857034b0ea4343fc

SHA1
7b1d1aed24c9d8275139b9ce3ee6418721d6e1e2

SHA256
d2d481ae8caf20448b8959ef46513df42496a5589c415a52d28badb9674c5fe6

SHA512
0411a0eae80394209352eeb5ac1905ed16e9b0acae574373065b555565a8c066b6528bbd0a1f8487c67c2c2a643fa433831e2f08f246b1750cc41b0a07f5850e

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
14KB

MD5
c96d0ed00cf6d2b3e56cc6e658693c8e

SHA1
9c1d17ca2c96baacd092ecfbf3646b147dfe48f4

SHA256
d86411e192afc78ac104beef12a1813fc6b4f89869fca14835656d171e9bb116

SHA512
bef387c83f68f1097d64ec4383c19123622c564da67932df8ca12c6de72f137a0276845472b88b2066fd8f222d5a3e2539d2ba8f05a9c62abeea4374c74d2831

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
1KB

MD5
a2ec2e91c3ef8c42e22c4887d032b333

SHA1
e2c738a2e9400535b74e2263c7e7d1ecefe575f2

SHA256
8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3

SHA512
b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf~RFe5cdfd8.TMP

Filesize
184B

MD5
3cdebc58a05cdd75f14e64fb0d971370

SHA1
edf2d4a8a5fc017e29bf9fb218db7dd8b2be84fe

SHA256
661f122934bbc692266940a1fe2e5e51d4d460efb29d75695b8d5241c6e11da7

SHA512
289c40fae5ec1d3dd8b5b00dd93cf9cada2cb5c12bcfefea8c862ddf0a16dced15d6814dad771af9103b3a5d3016d301ee40058edde3fdea30d9767146d11cd6

Download Submit
C:\Program Files (x86)\Steam\config\stUI\Steamtools.exe

Filesize
16.3MB

MD5
1a475aa5000d3958df447de17e0dc14b

SHA1
8a45a8a2b38a524633a99abc7994aa0ac46c03ce

SHA256
1208c4d240918ab0b4767bc6a5c0cbe83ee7f21408fb0c5ea68769ebea759b3e

SHA512
e86be352a5732d18db772f3fc80a70ebb223d68148057663ed18aab5c2221fe6d1cb48d4f4e22940419e9144aeacdc03ea05739352f86aed7ce967afd7e80911

Download Submit
C:\Program Files (x86)\Steam\crashhandler.dll

Filesize
347KB

MD5
7a93763803b9ea422e70015fcb23f981

SHA1
9765753a26e91b908acca2e88a3c1db9d57b2f53

SHA256
85b6c815533b6016062e3536eb04bbe0dfaed8e3c89eca8da1d586f12b780001

SHA512
0748982ce6f5db44c09e6f9a01ab343ec81adb775bf10ec1bcc84c51c7bc3710c165ec7286db587a4997815926b480f1c53a9b87f2762baa7b28ed4187a7396a

Download Submit
C:\Program Files (x86)\Steam\dumps\settings.dat

Filesize
56B

MD5
0e58ebd27d590d5179907c7b9f58d98c

SHA1
aa9661f42c15a85887b83e9a1417eed344998788

SHA256
3b0e005560e8cccc41478eeedc59083f95a12da21e281e3ff38defbf60a18d64

SHA512
a04107013c5f30d31778c6b4046e75b97205e4e70a08174c8106df071cb424b555858a654d8c6afec22cea3f21be4fa24b375801603b374c247541c5fc563f58

Download Submit
C:\Program Files (x86)\Steam\logs\bootstrap_log.txt

Filesize
44KB

MD5
d0bb271d6922e2db440360c6fc7e2540

SHA1
baa8fdf3ef758405e023e2907cc841993c707876

SHA256
d7180ab052f3785ea2cc9f6a1aa57c6da6b38af15c96a4395f0ddf337c998723

SHA512
d041087c68a4aed6887a0292b4f7746138123a0eef6fceb0b77fee8101cb38443d5c5e2558ae0e490f9e248dfd927ddaa6bcdae50aeeeff5fb95cf9343841d07

Download Submit
C:\Program Files (x86)\Steam\logs\cef_log.previous.txt

Filesize
22KB

MD5
9b902f4e362e8003a97c0a3fdd67ed19

SHA1
da0005bb16e41d2f2b4a3f46829ff1ea86ccd7b4

SHA256
019ed29163f1681f19f8dc802791e28a517af1748639576aeb9fae96e68f5233

SHA512
971221ac7266445739139c775a16064a995c345e1cf806116c1f21501eebe47469309955ea05de854ac5d5b8f9680fcc37a7014023aa0ccf84946f1cab12cdcc

Download Submit
C:\Program Files (x86)\Steam\logs\cef_log.txt

Filesize
2KB

MD5
186462f31da4458c486479f79af6f391

SHA1
455aa21d8029f93f51b7d18e804b6033dd754f91

SHA256
cce9e53b81c11d88863012d9498725e7d227c844967e472747c2b4ffb1dee6d7

SHA512
210adc524acd3b68df08e8decdc262b69ce1c32cd8224dcc139fecd4daa37fcf8c05da9b7b37d03f3e37752d4bf2c098d3f815519b7d92635c6e00f199059960

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_metrics.bin

Filesize
2KB

MD5
71fd02789f384c68674e0729bbdb51b5

SHA1
28b2d0e7aa5e7f103c2df6e90db9d9dd50a914c8

SHA256
42f9fe8ec72ddba8b27e56ef3f31ddd4858f8933b34e3ced50d1c807e3001aba

SHA512
ba08990742ec51524cc6b8b283086fc963b3f950d38b3955b9e918b7ae0949de2468841b15ed9ef4f5fdf98e93f30304fc17b1786a73fbe5c6c9097b302bb01e

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_win32.installed

Filesize
462KB

MD5
4521a6206cd321e2ab326d6afa9b363c

SHA1
461641c39fde053d494253e72ab2f22d84fabe50

SHA256
04d04c2c9b1d82949bb4d3724cc477a9e9a7f0873d4fe6fe9840ac3e0971ea24

SHA512
fe0bc85d077ba19584f6a02649c5b675efb8d0788a45c051aefc40b3120288abf68bd8cef7e62f35c2ceb21547c4aa7fba149441a66636d013821b18b4b3d5c8

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_win32.manifest

Filesize
8KB

MD5
78079dd63939f7c2db1ae475b12cacb9

SHA1
a2dda051df71353b2fe2cd8600a6714650ee37ac

SHA256
529e2294203328f262b6fdc8a4b26077840aea72b8a1e752603ce8c625a1db77

SHA512
74d4f33c2eedada639378e9b32f1703cd67cede37dc4ce0dd733bfba9a6e6a63a3ff667c2a6616961c56c2900888288d7d2aa3070269ea6696771cdccc05b132

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

Filesize
15KB

MD5
577b7286c7b05cecde9bea0a0d39740e

SHA1
144d97afe83738177a2dbe43994f14ec11e44b53

SHA256
983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

SHA512
8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

Filesize
20KB

MD5
00bf35778a90f9dfa68ce0d1a032d9b5

SHA1
de6a3d102de9a186e1585be14b49390dcb9605d6

SHA256
cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

SHA512
342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

Download Submit
C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

Filesize
23B

MD5
836dd6b25a8902af48cd52738b675e4b

SHA1
449347c06a872bedf311046bca8d316bfba3830b

SHA256
6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

SHA512
6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

Filesize
4KB

MD5
0340d1a0bbdb8f3017d2326f4e351e0a

SHA1
90d078e9f732794db5b0ffeb781a1f2ed2966139

SHA256
0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544

SHA512
9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

Filesize
6KB

MD5
4c81277a127e3d65fb5065f518ffe9c2

SHA1
253264b9b56e5bac0714d5be6cade09ae74c2a3a

SHA256
76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9

SHA512
be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

Filesize
4KB

MD5
2158881817b9163bf0fd4724d549aed4

SHA1
c500f2e8f47a11129114ee4f19524aee8fecc502

SHA256
650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7

SHA512
f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

Filesize
4KB

MD5
03b664bd98485425c21cdf83bc358703

SHA1
0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

SHA256
fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

SHA512
4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

Filesize
4KB

MD5
31a29061e51e245f74bb26d103c666ad

SHA1
271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

SHA256
56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

SHA512
f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
da6cd2483ad8a21e8356e63d036df55b

SHA1
0e808a400facec559e6fbab960a7bdfaab4c6b04

SHA256
ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

SHA512
06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
27993eb75894ca4894db266ad9b5e61b

SHA1
4def653ee04b0514822b690052598435ec25e686

SHA256
fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b

SHA512
eaebeee5b1a7dfb9bdf661623554793d7ef7e15d9f9cf01f94da1eb0b84b88c8f24176463d15c407ebf670c5b7fd4052daea33ba43e75c1de2979487c4987bab

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

Filesize
4KB

MD5
9e62fc923c65bfc3f40aaf6ec4fd1010

SHA1
8f76faff18bd64696683c2a7a04d16aac1ef7e61

SHA256
8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7

SHA512
c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

Filesize
4KB

MD5
10c429eb58b4274af6b6ef08f376d46c

SHA1
af1e049ddb9f875c609b0f9a38651fc1867b50d3

SHA256
a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13

SHA512
d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

Filesize
4KB

MD5
5c026fd6072a7c5cf31c75818cddedec

SHA1
341aa1df1d034e6f0a7dff88d37c9f11a716cae6

SHA256
0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382

SHA512
f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

Filesize
6KB

MD5
189ba063d1481528cbd6e0c4afc3abaa

SHA1
40bdd169fcc59928c69eea74fd7e057096b33092

SHA256
c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695

SHA512
ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

Filesize
4KB

MD5
18aaaf5ffcdd21b1b34291e812d83063

SHA1
aa9c7ae8d51e947582db493f0fd1d9941880429f

SHA256
1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

SHA512
4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt

Filesize
4KB

MD5
1514d082b672b372cdfb8dd85c3437f1

SHA1
336a01192edb76ae6501d6974b3b6f0c05ea223a

SHA256
3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4

SHA512
4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

Filesize
4KB

MD5
8958371646901eac40807eeb2f346382

SHA1
55fb07b48a3e354f7556d7edb75144635a850903

SHA256
b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

SHA512
14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

Filesize
5KB

MD5
7e1d15fc9ba66a868c5c6cb1c2822f83

SHA1
bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

SHA256
fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

SHA512
0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

Filesize
4KB

MD5
202b825d0ef72096b82db255c4e747fa

SHA1
3a3265e5bbaa1d1b774195a3858f29cea75c9e75

SHA256
3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314

SHA512
e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

Filesize
4KB

MD5
7913f3f33839e3af9e10455df69866c2

SHA1
15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

SHA256
05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

SHA512
534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

Filesize
4KB

MD5
58e0fcbee3cca4ef61b97928cfe89535

SHA1
1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b

SHA256
c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425

SHA512
99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

Filesize
4KB

MD5
9b0b0e82f753cc115d87c7199885ad1b

SHA1
5743a4ab58684c1f154f84895d87f000b4e98021

SHA256
0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

SHA512
b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

Filesize
4KB

MD5
eb8926608c5933f05a3f0090e551b15d

SHA1
a1012904d440c0e74dad336eac8793ac110f78f8

SHA256
2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

SHA512
9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

Filesize
4KB

MD5
6367f43ea3780c4ee166454f5936b1a8

SHA1
027a2c24c8320458c49cd78053f586cb4d94ee6f

SHA256
f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998

SHA512
31aab33e0d272cb43a8c160b3d37256716a683e5052192fd0e4d3cdaf30a10a9afa9d26d5d14ad216ee455627c32892a711d2bc137ee7a7df9a297f001a19e32

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

Filesize
6KB

MD5
e04ad6c236b6c61fc53e2cb57ced87e8

SHA1
e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

SHA256
08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

SHA512
0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

Filesize
4KB

MD5
56dcf7b68f70826262a6ffaffe6b1c49

SHA1
12e4272ba0e4eabc610670cdc6941f942da1eb6a

SHA256
948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

SHA512
c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

Filesize
4KB

MD5
66456d2b1085446a9f2dbd9e4632754b

SHA1
8da6248b57e5c2970d853b8d21373772a34b1c28

SHA256
c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4

SHA512
196c2282ba13715709ece706c9219fe70c05dd295840082e7d901b9e5592e74b1bb556782181cdbe35bd1ab0d6197fef67258b09491fabc6f27606dbed667d49

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

Filesize
4KB

MD5
b2248784049e1af0c690be2af13a4ef3

SHA1
aec7461fa46b7f6d00ff308aa9d19c39b934c595

SHA256
4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

SHA512
f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

Filesize
4KB

MD5
194a73f900a3283da4caa6c09fefcb08

SHA1
a7a8005ca77b9f5d9791cb66fcdf6579763b2abb

SHA256
5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6

SHA512
25842535c165d48f4cf4fa7fd06818ec5585cc3719eff933f5776a842713d7adb5667c3b9b1a122a1152450e797535fc7a8e97ebdd31c14b4d4900a33ede01f3

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

Filesize
7KB

MD5
53f7e8ac1affb04bf132c2ca818eb01e

SHA1
bffc3e111761e4dc514c6398a07ffce8555697f6

SHA256
488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83

SHA512
c2e79c2505a6fd075df113ffce92ad42c146424ca39087601daa4ed15a2b5528d478a093921d9d8a738c7b6b963275a0693ebe526b6e2135d14ced03639d0e70

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

Filesize
4KB

MD5
29f9a5ab4adfae371bf980b82de2cb57

SHA1
6f7ef52a09b99868dd7230f513630ffe473eddf8

SHA256
711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

SHA512
543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

Filesize
6KB

MD5
cadd7a2f359b22580bdd6281ea23744d

SHA1
e82e790a7561d0908aee8e3b1af97823e147f88b

SHA256
3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99

SHA512
53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

Filesize
4KB

MD5
f350c8747d77777f456037184af9212c

SHA1
753d8c260b852a299df76c4f215b0d2215f6a723

SHA256
15b6a564e05857a3d2fd6eec85a5a30c491a7553d15ffc025156b3665b919185

SHA512
efb86809a0b357b4fcd3ba2770c97d225d0f4d9fb7430c515e847c3dd77ee109def4bef11b650b9773c17050e618008fc03377638c1db3393ac780b5b0bc31b2

Download Submit
C:\Program Files (x86)\Steam\resource\filter_banned_english_cached.txt

Filesize
1KB

MD5
009ca439b8e68dbdb83850d51b07c736

SHA1
b8dd1986d15aef3dcba09c954577c780b549c582

SHA256
4bfbbfd0114ee78d7795835c64aae6dc6b525547748c5dd1150d7d1ff8757c43

SHA512
25e90b8b737b30879ec9073457cc7b30bdc46ed71b8885ce14f9c1946476d65c6bbdd0ddc19bb09c406cd9439837aec5c8ad007dbb5a4378842e1634429b093e

Download Submit
C:\Program Files (x86)\Steam\resource\filter_banned_english_cached_timestamp.txt

Filesize
29B

MD5
fcb75cc341567f6c02a96d3aff9b2efa

SHA1
5c8354e593108f577d67b8e3cadb0673cbf59d26

SHA256
d6a27188d1498fcc720fa3e9030c3af6bf7553ba8ef6b771dad6129f15716e59

SHA512
66f81738cc8c711254d4e2afa64209830067fd466745b4336e22c239887ea466e12f69fb7200a670bdc82c74f8e3e32204d3875dafba406091f734896cb1f27e

Download Submit
C:\Program Files (x86)\Steam\steam.exe

Filesize
4.2MB

MD5
4bf015883412d366a1423e51ea534a21

SHA1
e89e0e631edc7aa0cde78463e3b5a1250e3a976d

SHA256
b5d588810e2b68f8a92de74b9741e0120f130d1e079144d50951c54cc04ed72c

SHA512
3610e464336b85793da07de2dc9a4940936bc47314b0aeddd910f2558a7669249fb4d588fb29d3b862ebddc5e3cd2883fbccbde9c35ef7215c1c864525bfa4be

Download Submit
C:\Program Files (x86)\Steam\userdata\384535998\7\remote\sharedconfig.vdf

Filesize
165B

MD5
612629a164c687addf0f41423eaa1063

SHA1
724e55c0e004350594bd3bdbbcfc655d65f2552b

SHA256
cf5a02063eae586bea329bf75c293254431e8b5bae9f1a5a9c8723c5ed4ee1a4

SHA512
80a16de8d04af9261a1c08edcf113d2bf3342c86bac3ca6e03851d9d781687f3735930f9a55e66af86bcb0decac9f9714eafce496f46b0b9c6bf25f03a1398b8

Download Submit
C:\Program Files (x86)\Steam\userdata\384535998\config\librarycache\1276390.json

Filesize
126B

MD5
5216ef382c2d09e344ae46f2c073acab

SHA1
91040770b2b51d00e6b7c32a37315eef249a55bd

SHA256
2200afe5bd5dccc0cfe9d34b29eedc49014dd673e5b9b2d1797e3f52a14b5617

SHA512
0a5bc2a98fec77d33e0aca0934d547746883d5ce2b6cfe23e36dc9afe5fbd51dfe12d955213cd0123b4ca004e225182bea6722d0870ea65ba5a808756e893f7a

Download Submit
C:\Program Files (x86)\Steam\userdata\384535998\config\librarycache\444640.json

Filesize
10KB

MD5
cecb638d568ebe24f40c7d5156685847

SHA1
d5ee7c99eb1c1bfec8043faab5c99df761e1e42b

SHA256
d0aecd9e5e97e39223a0243f47dfbfc861f795236d38b6cccadb14ab70290d74

SHA512
cf6ecebca47946cc018a70d17a7520c29470c830cd071a3cf35fa21b4b1af1096d49477121d0991155f26c65d9c74e755a5e9ba160b87ee718ee82953c0456a3

Download Submit
C:\Program Files (x86)\Steam\userdata\384535998\config\licensecache.async5704.tmp

Filesize
8KB

MD5
a3cf67aaa2e3fcd454fc41df45cbdf89

SHA1
481b76134ade4972725d9be1e3d21c3f522972cb

SHA256
88a38b53ed4815754f308836b1ff996e2ee2cbaee5b91cc5a4922c004c038615

SHA512
7149abee60bb453197ca1325f3a2ff659d18048947f753fa91b84bb9717421a0adcc98b7dc6296ea6b3d627cee8c9d97a3da576d53d0daf552736e6c8e3b512f

Download Submit
C:\Program Files (x86)\Steam\userdata\384535998\config\localconfig.vdf

Filesize
2KB

MD5
bc86adad775c8351fc4e165b9c0a9e20

SHA1
ce78cc45d315c5b0a60ff13cf3b0377abd83855f

SHA256
7ee203874142a37d460ee4bba5adde3f1c9022e51a1636c14965407e70e5b85b

SHA512
487ff38061342c3ab60bfd3d36bd7d901c16da2afbf873364b5881075beb016af7c82db0e47bac35c808adb9f67262230880f37f448ce8a713e6ba84f32c7bda

Download Submit
C:\Program Files (x86)\Steam\userdata\384535998\config\localconfig.vdf

Filesize
2KB

MD5
3b3f543ca680370bf89780874cea69ee

SHA1
35a008c4e8591367047ee36e8fb2d904a05ad884

SHA256
2ebf7c2450f5565c0846bf159c1b9ce6542b9db964c9c90215582dbac386d5df

SHA512
5a9faab1a65f2d613ea23a5084e3c477a1b9d83166b261ae3f9b1c09e41ffc9cb49a2ff9b176bb4d4da50c9448c869ccfae3dd11afe2c1716c3c088a01654c8f

Download Submit
C:\Program Files (x86)\Steam\userdata\384535998\config\localconfig.vdf

Filesize
8KB

MD5
13db90cb969bca16c4fbc33287ee10d7

SHA1
962123c9d456d9bcf5ff1370fdc3763bdabee4c9

SHA256
497b56374a9d466443c5a37d415bc499ec8bcdedaa27eb347d0aceaddf2ab8de

SHA512
b050123db384dc4ddb06a36e735641817923d043a477b1274d0d3f0cbb050537aabfccbeeee5bf9918d087d6f6f71934d9a81a8ab89ee88c2eb57cf1137a2c3b

Download Submit
C:\Program Files (x86)\Steam\userdata\384535998\config\localconfig.vdf

Filesize
10KB

MD5
6c6477a14a88b59ff75b906655c5c234

SHA1
86d9088836e60758dda944538e3325d67da95e12

SHA256
1c6738e831dda5083d6009cd353dd69a8442e877e51f52a3a6bc29de1b2d647c

SHA512
58247a078f383a6e0ec2849276847eb2d9819b7aee566459174ec7a64da0e70b84171e14a4fd91b7a6bc25b737bf457f4783b16dcf0a1e81cd99e4cc5b6ac194

Download Submit
C:\Program Files (x86)\Steam\userdata\384535998\config\localconfig.vdf~RFe5e2b54.TMP

Filesize
232B

MD5
eedfbdf15f4064087d23a6a0f2a9a9c8

SHA1
68c328528bd77e07bd44329e2b5184e947ccab37

SHA256
62b65124346e19dfb39cf77367e9a598a93c4f470da1933d6d6aa100cda9eed5

SHA512
dcfb001708474ed4158b5f3a5218c37de285b303e83cddd9b90a2a19f95ae4d0ca842bcc5bbe3c290ad4e9af6506bb92674dc16fdb7fd07f300f6bc81dac3412

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping14972_1928769534\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping14972_1928769534\manifest.json

Filesize
1001B

MD5
2ff237adbc218a4934a8b361bcd3428e

SHA1
efad279269d9372dcf9c65b8527792e2e9e6ca7d

SHA256
25a702dd5389cc7b077c6b4e06c1fad9bdea74a9c37453388986d093c277d827

SHA512
bafd91699019ab756adf13633b825d9d9bae374ca146e8c05abc70c931d491d421268a6e6549a8d284782898bc6eb99e3017fbe3a98e09cd3dfecad19f95e542

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\cache2\entries\586D25A03895848B0609C1B0C9097200E0CF65C6

Filesize
61KB

MD5
d272a06448ea3fe1dfab09a31e6fe8bb

SHA1
4477bffba416b870296c586f80b5513ece558dbf

SHA256
4d192c16f61dc554cf54b94b25697f10cca16101c9342f1bd72fc13110b2bc2d

SHA512
f391dc249aa7607888487e5595e6589175dec5c6b2dc5841e712d4e169dea93b21b37484557daf02a5b4856a44da51dc198d7bd88bd1885b9b7f4d8dd9de5c5c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\cache2\entries\DC904F6FE13AF2FDD1A89E5DC2045B0E5EE12A27

Filesize
224KB

MD5
ea576d125ae2943df8c883d6ddfae46a

SHA1
715f8c00ae5bef7cbf5e2f8b1a139a5fdfaaeae9

SHA256
a85deae7495a751f87f95f2666cb415eba7dce9bfc0800ece4d7824c45d92af6

SHA512
46f08eb1fe85055d9c07395ec615d8b8a62bd76a99228fcf52d9b0592d0ad8bd2e91dea98b420571aad748a040cd34f8a2421aca4005ae9a52773aba0d9de494

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000001

Filesize
19KB

MD5
6b831f3db51767ddc21f287180bc828c

SHA1
218035edf4f39635f755a25341d6f0ce5fbe6a65

SHA256
ee2a079993d679fed7cdba20f20eacab7466cb6c35e8ff9106a409c6b2a68a08

SHA512
4bbc07b86590429b903385a5af76cd62aa2f1b0e130d0a2816f587e2819f76ceed88af1089f172851d7a505a9e2a97938fb220c33c5b024839f2cfeaf5da51a1

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000002

Filesize
24KB

MD5
b201e8da90ef456598b8b3bb0e31bf53

SHA1
8bb524c8e9b17920c83d9a06c0b305e41cfca560

SHA256
2c8b630d1edafb8cc8c8cd73fff10c8ab6d06232929a4d458ec34628920f1665

SHA512
50126ac5b7800f5a848ef49ebc8e71d78cb5ee9c1602486b30e697ce57af32c868e46795ac2c157cdfd7fe65c03133c7a752813d520a9106adc3e50620b473f3

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000003

Filesize
40KB

MD5
0c9f37673dd9c878a4b5bb419ee24b5d

SHA1
d973a8e073c1f76068f0947d495998f7f823d76e

SHA256
c1e12f630e7f356d154ffe4a7a3873e7e136e41c1c37e6c0fa4d2c52f1d269dd

SHA512
b361afedb4a910b12f7dd7b5b33d2914be39528bf4d1486661d0107c24135cff3a5393df1af85cd7d1551f0e601ea9d2ad4b147e56f469691e2b11906fd1514c

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000004

Filesize
32KB

MD5
31b05e57c066452d73ab005bb42865f7

SHA1
2a8efd5d7753dd756c539ad66831b01f603fb13c

SHA256
84d0be622ddeef6d0793df5d274965d6d13a756979b4b484185dc7a051eb4071

SHA512
f793863cec23493b58311d37720fe7d48e21c92da5cbc9c5d4562e47a046e33be4584d58a1c031513298c55a9c33f5e591fd5ce831c9c33af9c2594bb071c277

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000006

Filesize
36KB

MD5
9d69a62bc96e67bf779bae3744a8f693

SHA1
bd8a95a103317e66551c2129fe392998dc45c7ad

SHA256
39ee252af15a86d1d4d54a5c3fb9ed2678ef2ecae9ad9d711290acce7a7a611e

SHA512
e1fe5393201c37a9c34196fb986e818d5a94545009c6536b3c6b1a1bf71d528d458039ef1f30eb1c064e233b7238b72f7cd69d204827ba8cdf3f783aa012ca10

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000007

Filesize
19KB

MD5
280188959917fc5a7ce9cbca5ba6fc05

SHA1
f651c19d05fb115f031342f12b36337d866c0034

SHA256
430750b0cb0ab5213be051d447bd370fa4afb2c0ca0275cd4f1beb8e0bec8f15

SHA512
fd0c1159142cfe42617bdfff51613aa6f72119e35d21bd1ef01a76697cbb8ecfff6059e52e8218be0e2fa37389a7e5582f5d6e9e0d80c2b00602337be5125eab

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000008

Filesize
19KB

MD5
48ffef4fc267c7350a37339001bd1a02

SHA1
9379041d4d542c116b420d014c7ebb68137a008a

SHA256
254467e453cf3cae3c70085b41462cd71b233c247b5e212f444347537b4c4873

SHA512
34b459dde39b3056e2f0a4c593b342d32829c9eebb2b01f146aefa0d54f0b52ecf4954873cf76b424abb25f84370d0b5ac06fdac734b397a7444b4b64b4d52f6

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000009

Filesize
150KB

MD5
52344bfd16b4f6d1dc61922468458ce0

SHA1
142e9ec2e44f56e7e97f243624655decd4ee75ca

SHA256
d4636d2d08503bfd82c4e2a614efaac77ed9aaa38793703e16cf8f73b445aefa

SHA512
4bdf08a37c220abdb1ff30a30b10573082960ea9ad4118d3a9abe3e0334aefbcbe07eb60cf17d9f8f4539c5f719a67c803a452a4e79ab64e71e7c7b83c0de172

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000a

Filesize
268KB

MD5
0bef1003dc5bf34496bf96ed5e244795

SHA1
08c366df05fbc5942aa9b3a85f2daad3ee1af4ae

SHA256
1c187915a32372c936a5d3930b914c5583350653ee52ecfe0c90128dd5d86839

SHA512
936a64cc0eeb507b6c62218f6bd96988b7b8d8a4e9e5307e0e08f05d79cd16ccfd2b57f8f3c4abc97a818883e38b0c2b6f477a1fad6b6619ff4feb384b847138

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000b

Filesize
55KB

MD5
9e1be399f3be8b33af07dd9756a4c51d

SHA1
52debd68f4c2b2e6abe6ed81ab8af8fb426555bb

SHA256
6242f451e1a623426354e3873031af506755faedfbfc788ff57945d634461727

SHA512
4bf71f46e296e4a2f7dde08b743eaf63bc7de90d94da0118c1b5c8a8774d89e03f2ec31c0bca895c515ec9652cbe3ccabad188bff57a4e00a723d0cb9515f9c3

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000c

Filesize
17KB

MD5
683a17aa0d0011080d0b27353394bfb1

SHA1
a8dfe7c2c1e472bb5f7a676a323635422b75fc0b

SHA256
84227bb1a9ebec716fcd541b0bb684a23032efec42d07a1e596fd92d0104e7e5

SHA512
57d742fdd3e7cf7de882caa2e5abcfa6491a9bf33851ef468528800db17c8880563c452fb0b6d67a2226a1f1003e270ef481a7477c1807c7571f3198a6c53130

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000d

Filesize
40KB

MD5
2844ff35bc034b7b8d20c51326870dec

SHA1
dc0910c2ce136fced6d9edab7c70f4c99b9d0472

SHA256
865ae18be7c3e131ed32ce440088471d952339055c94fcbb691c15e5e60af4e8

SHA512
fdde35954e395484c0e1c74953c3d83a927252090c93f321eb077d092284e018ff4ef8b3ecb8eaf8c0e090e10551181cad7a744a31e01417381aee5b14f5a035

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\temp-index

Filesize
48B

MD5
468abf85e2ec2e6f291d714e22762a6c

SHA1
925f0a9c55974f277bdcd8cde7f2e6d2e491c408

SHA256
c6e47854717ccef52a9bea03595b834d65dfa883fe92519d002fa5282f5df176

SHA512
af0b02b1e115494cbd6b625052ac0016871057be78388e0404e2f001f221985861adc60b8426fdb312298d1eacd36e72f81dbd4d57ead4d0d06dc30d15a5a896

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9874f0b715f6a0250937d8b2b02f5966

SHA1
f15ad299f25d2963a52c302a132c4b0362820d16

SHA256
7a108ca378ed8c461b6ab29500b11c1a735b997c66330e1f05f477659eadde39

SHA512
fdc34c12fa6f3c65529841d6eec6d61b543f006ce95d01fbda1783d2d65491e1d6fdfb5ff880eedc904ae2ba61c8310c229b362961a2843c0fd5a06160ed8a16

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
94dc670a94e514eec5ce5028542b6e73

SHA1
ad365647e7fae53d52a54f8a18d6483caead3f6c

SHA256
7c0d0dfffaf300faad85a0b260f6087615ea74338593f228165f1eb87628bd51

SHA512
f5653f3aad789663bf7bec32e7d19ddcbfba1f616e78b6675f66d6a0cfcae595678b8140e2cc329b3f1a8c4d168f8fdec29918919cf1e8e6b00681d195871506

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
cde2be3df1808df4da69bb5f9c4d473c

SHA1
4373dc293a1d201124ea89dc627330c4c7bca19c

SHA256
c70de22fc4f98ea57cfa1db82ea785821da75d8ff81f6d723ff1c3afaf3aa77a

SHA512
72950ec17ff110f956a4d73182c23ec7a86e8495b9c1c0a3e690cae7d38fd636c12b176a7022a9ec24b954bb85a47a9b8efc5e65f992eb745851da1e6ffd7435

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
726B

MD5
8a9e4b80542e43fae9e9483d9092ecef

SHA1
6080666839750bd4dcdb9626564eb0928bd1389e

SHA256
634b030cb8ad4fd6a914371850074d95bfb9f1c76bbb51918c086beae7be6a81

SHA512
58ba4f381a56c2c753c6a48427a90bdeeee3a7a007ca77092bc7db8280774a2d192872ac0e73bdabaab3b9ef1b819e066eae1a2731f23c73f694809495c584fd

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
838B

MD5
309f16a1d9b2007e29c4937ab738132e

SHA1
79d932e24d92048382a73342f36f11f52d715de0

SHA256
76366d2c6ab71894e36e70714dc17412cd3ce34e454bc04d9e148892ceb8f26c

SHA512
85c171fd3f079920bf592c804a2886477bd27b2fb454667297d1cb6df25d08479e7d57e307ff7a48f241de00f301c7d12d72e80493ef1223b1b17abc5124d53e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
650B

MD5
a52bc2ce7428cc2c688322ab7ea225f9

SHA1
0b27721fe3ec956f7399da2eba2160c9e95acf54

SHA256
b39c66e6c44ffb62091c69c07d6b85e6ccd7022ba84f1f98145fdfa0f4d7cd9f

SHA512
20d4eb9226ed287ad16a44e958fe64be2d56c4c2485452a3e1036d94bd1a336118e2af04cabc09b5a2c08518a4c4a825235af2b8ff9b1bd16f17938f96b9febb

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
300B

MD5
be32afd1067cdf370dbcb19efdc5bc1c

SHA1
8291ddb6410a1cf38386d6867a839a7e0a142fd1

SHA256
13a36fde38be5ea85e6d20d1e762f7aa1df3620662d6982d109dadce28bf2d9b

SHA512
bb08207d9bd0f1d96ad8173cb871b353fab2900705d5429715acceea442f7b8d2cf3223d2e357af720142c6ce0d8179e75dc7463e493fac07816a7fbf031bdfa

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
898B

MD5
81e703619c9da94613d3c1676a6a349e

SHA1
553752d232c3567522f14f2113090bca94ba8f25

SHA256
533d78ddfdb2657c4d53bf3e2bbdaeff82151ec681074da9f8e947f27a59e1c5

SHA512
5fe833bec2e2b2581311b6c6b11cebede4439d4f8c51494ab334989832ec0248d3d5b43456412daade5ac62a6187c71c99be8692141a2b6adbf73cc1ae2ee886

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State~RFe5d425b.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
524B

MD5
b448396546c45718c1e3390db8664170

SHA1
811895b5d0c3c592a34cd2dcaad147c83bb4806b

SHA256
08401bcaa48e7e67e6272123e0968d6af1e5db02b62a1af9ede1d5ac9cc19f1e

SHA512
9a00d9488157eeb1ae942ed2b95c37ff949fe7a5ca951e705264ede439c2978d6d630142b697042b1f99704a06ac94c1429a649779e37f069d3b41e01613130e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
524B

MD5
9252792cee60443bd91bb7b73ee47956

SHA1
2f781317932b7610592e841deac88c4350d3e780

SHA256
406ab023bcc1edae0105cb8ee7ba2f83d15620db0ad6425fda00f11ff9bed304

SHA512
6a3130495c4edf0d3bc2e5fb61c8f1b137ead441bcd4df2eb5ec6c407f92ff81ec01b6691c913c1502780cdb186bcd1282466e44be9c41e755ee489d0524bf2e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
188B

MD5
5ac51aaabdf08b8fdeb8dd5ae90984a6

SHA1
9bf9ecd2955d894dec76b56ac2ae9ca8ead186bc

SHA256
8a3839df923b9e511a375bfc9a6dbb4872f6e4c0996e5216ca122368159c7d65

SHA512
20d876203939f3995ed37cdc7725f7e888d57a52c742d4259eb17049bd056134917c13798b72f1ae1e55198f7cff2b31c8b4a9ae818337dbdd8d707979282825

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
524B

MD5
6cbb412e125bfb83c2d20b4d319c618d

SHA1
142db8f434c9d303a74790a2b5e7507eb5d93f14

SHA256
4dc1d35af81d37dd8ac659c0d91f46aeacbdbc40a5cf197dccc0a46d6a07e962

SHA512
769f25d3f2fa789261aee445216028a7119ce4154594c56bf28119c50ee6b6814a621dbca11a0da439ba97be406443ac9fc51300950870f9fb750c3335fd9df5

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\cac8467d-403a-4fd5-9bb1-f2f75c9d6f84.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi2FAE.tmp\StdUtils.dll

Filesize
110KB

MD5
db11ab4828b429a987e7682e495c1810

SHA1
29c2c2069c4975c90789dc6d3677b4b650196561

SHA256
c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376

SHA512
460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi2FAE.tmp\System.dll

Filesize
22KB

MD5
a36fbe922ffac9cd85a845d7a813f391

SHA1
f656a613a723cc1b449034d73551b4fcdf0dcf1a

SHA256
fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0

SHA512
1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi2FAE.tmp\modern-wizard.bmp

Filesize
150KB

MD5
3614a4be6b610f1daf6c801574f161fe

SHA1
6edee98c0084a94caa1fe0124b4c19f42b4e7de6

SHA256
16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

SHA512
06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi2FAE.tmp\nsDialogs.dll

Filesize
20KB

MD5
4e5bc4458afa770636f2806ee0a1e999

SHA1
76dcc64af867526f776ab9225e7f4fe076487765

SHA256
91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0

SHA512
b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi2FAE.tmp\nsExec.dll

Filesize
17KB

MD5
2095af18c696968208315d4328a2b7fe

SHA1
b1b0e70c03724b2941e92c5098cc1fc0f2b51568

SHA256
3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226

SHA512
60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi2FAE.tmp\nsProcess.dll

Filesize
15KB

MD5
08072dc900ca0626e8c079b2c5bcfcf3

SHA1
35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37

SHA256
bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8

SHA512
8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
a8c69119983197efb27023b3dbc2ee15

SHA1
4aec42212331eb5e2e145f6a12cc6d9964b60f25

SHA256
683bdd23f3129c244e1fa173f8986a742c7dc4fd4d5436af76285bfec71a2470

SHA512
2e29cd1f62fd569905f72e13c80fef701d26fb211acab1d068505293f0b3d3b1ad8a6411e5cbf25faf67eba5bcf03d65f21c01887149b05499aaf553a32234cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
b84c9e541fda6d8a459e985f38f572ba

SHA1
6045d677d1121a1cabe361fa5a19a60925842845

SHA256
e57f557f2364ec49e86cfeae9f7446ab35df3cb418480bd785c8e35617d55477

SHA512
d34ad77cec78a29572c0550686e113f81933e936c187ffde6c7bd81cffb98987459a6385cae86959af77da5e796202ee90d2450c0dd72a6b86bf6f042476ad8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
a30bfac5fe5c75a847567571ecef4a2b

SHA1
0a8a518f1a295a0254bd767c8343467ee14d8197

SHA256
9fbfb6a178647099b539fd564b1b87d07af973f963e0bdebe6964da15ab008eb

SHA512
9fde8c585d93f17a6fcbd0c1a4b9ed9d4d68caf2d9129d33e15cb665716a8cf988fb3555746999f436b0775cca0093e44c971c104cf735aa314938daedfb668a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
9767ab6e1f22898881f85cfdc18783d7

SHA1
c8b5f10c9e67d7f0de6676f1b739402042249d18

SHA256
9024513ae150e4243307e3c6079394af292cfed0912749196a5456243c1847ab

SHA512
9c4a460c50eb916ad6824364c79b86af2b881f7bbc87eee9e6fe90e3c3fbe5fe5ee44fc0a1fd58990acb3a3f3c44034d1ac9f354f91f93675930c145ba5a6815

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
6b01a49f1e9bfc292cd4fcbc504602ee

SHA1
b0cb46b7430aa3f71213527aa87b8a9ed3efbeea

SHA256
e4c9414e4ec9e8a9e2db905d003d6746bbca20890207c0940489c04740ad43c7

SHA512
4579679b65caf7c2c25029b028b59ffdfdcde6f7669ccb99682ce30e20d7eeb7954843e921206d9705ad62f3817888c14d0b60ca27c8c0d1702d87f25f9acfcb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
8636c10bc8c53040a30d710e6955b7eb

SHA1
482249cb0d796c06eddfd7a24d7913ccbc0cb5da

SHA256
8e4998006a2dd0dfeca46497e8f5205468725f15a7862af41758c895e785507d

SHA512
a2c6f236d0fab8016c904206d8ac8ba1cc493ae5d0d35c7c8f9d405ddf75f5217ca4ebeb10d4993bab73aa598493fc64a432194ebf86915078bf0b6a942d1b87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin

Filesize
8KB

MD5
b291682ceea744ec69502c7d8f4b4de7

SHA1
4f2b453914d93a2104de509d1873c7cee27b0db1

SHA256
bd67f319510886b7c57a8563bef71ada2a7e11c02eb54b3cdbd736827393d790

SHA512
87b349c1fd49db3311ae95d94179c49ff6926e9007c719fd4a0449511e72ccc96b8ceb469ccdc7ad32461cb8b394ec254805a9b57e45a408df0f2d3645c45db0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin

Filesize
12KB

MD5
6b8d7de7e1dbd25b260b71e9a7858ecb

SHA1
4fd6b56e3673aa87b6a5869f6691ed9cf36370fd

SHA256
e7f2a83da67c470975beb12ac0c96233c712f0660144a2a5a47407d07af2f08f

SHA512
d761cf68ccc7e431c29ac1a20ec448daaaa9bad40832f978fe91cc077a938346f91aa30da8b9a77df26796cfeac1e56eaafa389be8e425a3d35f5982d494d644

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
e35596988d614acedec51017f41376c6

SHA1
d1aa64c4ff958b6f436c8e5a7d5de12614cf0426

SHA256
cb35b38b8a5fac71ccc432d276beb3709f1de6f87ece72262d34c523eb9b6d85

SHA512
9930e360171529ba8e0e17528a4ffa3eb27c1553ce88a93a63192202b746b808e8b630e8f7aca08a26b71f1a825a1ccc586594874a1d6edd0b14b6d4caa8b6c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
f8ad2ebc9a888e57668651845c19e1e9

SHA1
727f51f34741caefa61b04b8ba62e03f7bf34ce5

SHA256
e9f46916bd4b0deb96c8584fef5eb6eb3054b15c69bcfad2ca7e9c9a7f3cea96

SHA512
dd672ebf3c607f37c7977d70168d86133495a63348e21347cd11b6c56d8367af12250517fbef72c0a8285f32cb1042fb7107a255e1a57da5128198b022088165

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

Filesize
24KB

MD5
297297696c0999e3a6079030cd564a7e

SHA1
4b55f69b90cd487dee5c76827115350bc0f6538b

SHA256
fc1aa63f170f62ae935bbbb51bf179689b3154fe1c9e82d2a9287fba8a65a7cd

SHA512
2235abf03719568f21e79c6ec24c7fab9b40d1f02a67147e15fb5af16f5b6126751704eafe91ec271b557c8f1cc1f19ffd6848f8f3b74719d7d2b27c2868cfa5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\90dfb211-594c-42d5-9c44-f4fff106cc99

Filesize
671B

MD5
b14f08d3c5fe13cebcef173c060a1837

SHA1
3f3b24915a34b9b6b7408fd98519fcd37edc81e8

SHA256
71d3b1a7efd9c202ab4d07e37ecf79cf0f6c0d58ac549c03d1cd2cbaaa38c194

SHA512
97f0ee854272cc22ab384e836de4ee66ec59897a2502c329274f46ade7e5df6633fa0a7b39f8ba718b301e593191ead5ca86d53e45551c594d15f728d455f3e9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\b7a465a9-bca1-4f0b-bad0-0cc40f22f258

Filesize
982B

MD5
c8685cd4e26d678d649b0e71937fc83e

SHA1
f3ca010692ed368b9c3a8eb7153757e183ea0803

SHA256
5cca6965d54e61cacc7c1dc3dab77bc829ad5be057d93a18cf54997ede4fa7f9

SHA512
950dde5239c7183252030be92a30787b85a6cf3ec2d474c9d0121ed3ee48467ccf7ce6cc68d7e26b447a9b66d10fa8fe7f1a93101894b8cc8f5db592061f9340

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\ca573a1d-0e72-48fc-b4ca-9f418473cb09

Filesize
26KB

MD5
04f70bcfbd007d5349c96814933f73d6

SHA1
3d73dda707946414c417d96737f11ee88948c082

SHA256
421e3535544386fd45778709061d08e11ac0d433a353848326d6d66ba7ea15f2

SHA512
d30f41288dddbce2edb370ee5689bcdfee10cdae1c709b3723c377dc56796278ce9e5a3214c1cbc9e54d5881b775389e9770df50a9eb01f7a84d593a3eff2bcd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js

Filesize
11KB

MD5
5cc1aa34f3c686f3bd9d28dd1799e501

SHA1
6fa5774cb77a4327c480f8465189fc498be0a435

SHA256
a890bf31efad276badd7d1004c2306eebb22ff2416061040540cd2f46af113e2

SHA512
60f578e8282085656326cd351e0c9382b3f84e5e23a1843a6193bc1186a57abc3e719a492f9d25fbf25a8138fd4c72ebad77300d9def07ae52184c7b64f2bcca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js

Filesize
11KB

MD5
f94f3e6300b320d76d06483a4d4f6649

SHA1
45649cccb68b15413f1ce1bc38c4ddb80dbb6614

SHA256
6f332c2a8752ab195b06e53bb826eb34e4ae0d9de846bf7879287866e1335840

SHA512
bda2972cad4bbc8e35c0aee2cea1d73659d5fd39590b1ef1e79c9a6a13d685b16ea01d34257d447cf118b1b6c69f795acbf3e2fdc2e1a2da8f8ea5869808a3c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js

Filesize
10KB

MD5
d15a907f18fa0c20e766bc756bf60f7b

SHA1
c382a6c3e85572e856ab6a84b874fc2122f4083f

SHA256
c6af4f9ae6f69efb2ce8439a58f6d4686db16ae40fcf18940e7c7ed8c55fb5f9

SHA512
facf48d75dc3cc004d945e242ee614d5b75f36297f99866ccb569f1f1625b414016460c13ed62d1293247a59262d6daddc72c17b6266d8d20f0d9d526cbdb60b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js

Filesize
11KB

MD5
3cab2acc0ef50650b903aae5520aa4a1

SHA1
94e7250a4798a80f9bcfb34b89306fa329d8f66c

SHA256
ef3a5bc57f64be963220acb305fba628b4735a1c78c461910131a92fdc2c0c11

SHA512
0cc3c810b54a6addb313fcdeb945a87414d8ca95dea2b60bae105c4ac1488bf99fd18ca2b859c1aed2a476b3ad1b95b425e2f0cec37da0bd73c35143f43e317c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js

Filesize
10KB

MD5
0b5daaeef8e4c91e072afcafed6a039d

SHA1
9998cf5b28f24b38a23eed3b9cc22bdd8c9808de

SHA256
9adfafa14c56e2770136a44fdd0f9e915b20fa1723dfad103e8bfde20c4c3d55

SHA512
636e93cdba7e999e526fe7b96ce5474ea6b1c1f98b0089f2fde6df2ce6db42a9d5ff37380140af3d38341fe2c0713810672afe5e8200cb935905bf030255bf07

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
9a8aebbf0fb0612c0492eb48d85553f6

SHA1
6dac4bf13ba44cfeab64044461416608744968b8

SHA256
29dd2aff866a687c25d86d770f8fcbba8618eaa9374749de669ef4a3fe8169f3

SHA512
927bda89043dc1e1424b4ad98bedc5ea2bc17b16f50ec0a7ad38cd2066d5d0c41c681ef9780c27289fada927869c5d23af97ec8bebb61e62a4e583d55d93c585

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
0199eb577be43b63aed301aaaae09e33

SHA1
ac833fb8e516856e2b530ecd8bcb65bb10f05abd

SHA256
8ec4ef06a1276b921d90b2551a4fffc6c1c50e6e1b8731a6bed46965b381ce74

SHA512
50ec142767118948f317d58d5f5008d97866540929d5bfab3d9aba85c961e96ebd7c7d1a710b1227bbd2e820902b8bc3ddd157ed74a40f0f2e18b17889655f8c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
e535d3a09aba4a473296843bd8813010

SHA1
621f6ff64770d5d4e5a78f67a24c7422a297fb8f

SHA256
fddb5c5dbf4e5c8ad966b4b3191c25e4c22d03884bb84c6b79b8d104a136a87d

SHA512
e74e2ffb9990b56832cdd56e33cb9bd79a12752f5e1a815625bef45c9c8c04300a5f3a339f7edd41587c58af0b14c82a1fddd5d2cb8ecf461e67ca44013f2a52

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
017f6a4e4e75b83b78c1255241b39002

SHA1
1e543eadc63383bc73d5e6dfdd73297ff381654d

SHA256
e45cf198394c92cbb6a97e232571b5a7dd502bc7889f6161782ada03f22f9b05

SHA512
328f28cd8bbe9ad61208088d9794a6959052341d80e86b2b65387d049aafbee7e7c9277f60eb8d84ac72a7aaecc8ef927a35e39d6dff46b31b0681eecbd8b07e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
c50adafeffcec982ca83773cde2c4e88

SHA1
42ec85f57a8f2b4f45c20c9e5090ac44925d53bb

SHA256
0fdfc976b33951c61aebcfebaa4ba08271a9f1f6e7faf591d81ec4f6bfabc98e

SHA512
37ffa2222c14e82094f073686439c3b8a739247f7579481cbe7b6e0a3bd4ffbda889d9ef0529c449630a15089914ec811efdb8b7380eb0889501e902b4cb89b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
c1510a978d621c679c130aea935e7cc2

SHA1
0adb4ea81bfe1fc69a54811db66fdb14d21133a0

SHA256
e6b594385b35517bdb9cbea280adb6c11e8bef5d253d03facd3fad4d8cedee62

SHA512
1f40a5f824f8a938e14986a765750aef3bbb3f73610e80e6d6861080378704645ee70974c614020c07673d8533a0dde9a4d61a514c6853a6a59483b7d6013939

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
951cd68f963b68252a57e8e496051095

SHA1
ad54783696b6b49a8d49288f9a7dc6441e555081

SHA256
11d6b7e74c3b07580e1aca52b6178d5e832733565e28872216a72060b2ccd625

SHA512
f6923a44063b174599979978a2b88d7bd57456890a5c4e258254ca14ee3d9beddec05f98e99909245daf1adf725b00cb895999f5413c44583ee41ce12e22f26e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
dc297c09f1b719c15cfdf0ace288dd0d

SHA1
6cee14765ed8b2cb436fe395b60c30018297555d

SHA256
b1f8a08081cd53d630633d922633b608af41db4757bd2caa813c971dbb17e32a

SHA512
c8153b41d9ef5be87d440e0c299f9d301628374ab0a9098015efc64c5d2224d7aede710af49a8a27c92c18f0e8bf07ff682d63fd0e2e0aee8ac350da323d7e76

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
560KB

MD5
a9003fc2528b052ca7e78c0f110d3b3a

SHA1
bf02eccd70eeefa7fd8ed13f02fbc6897039deac

SHA256
ec56383f1967bc7cbf77c63f0b91bd771293aa899f190fa0dfe086d0a7d1114d

SHA512
a6f191143e7ed5e8f524545aaec27758ff595d03f205d081c1edeb681eb506a72552254c24df734c13ffef0c9d4921c39259ed088737a1333d9562f5bbca706d

Download Submit
C:\Users\Admin\Downloads\SteamSetup.exe

Filesize
2.3MB

MD5
1b54b70beef8eb240db31718e8f7eb5d

SHA1
da5995070737ec655824c92622333c489eb6bce4

SHA256
7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

SHA512
fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

Download Submit
memory/2244-13266-0x00007FFB78A50000-0x00007FFB78A51000-memory.dmp

Filesize
4KB

Download
memory/2244-13393-0x000002809C410000-0x000002809C53A000-memory.dmp

Filesize
1.2MB

Download
memory/2244-13267-0x00007FFB78A60000-0x00007FFB78A61000-memory.dmp

Filesize
4KB

Download
memory/2568-13534-0x0000014159B80000-0x0000014159C95000-memory.dmp

Filesize
1.1MB

Download
memory/2568-13390-0x0000014159B80000-0x0000014159C95000-memory.dmp

Filesize
1.1MB

Download
memory/3648-13206-0x00000000002D0000-0x0000000000782000-memory.dmp

Filesize
4.7MB

Download
memory/5704-13642-0x000000006C580000-0x000000006D8C1000-memory.dmp

Filesize
19.3MB

Download
memory/5704-13551-0x0000000010000000-0x0000000010337000-memory.dmp

Filesize
3.2MB

Download
memory/5704-13617-0x000000006D8D0000-0x000000006EC11000-memory.dmp

Filesize
19.3MB

Download
memory/5704-13630-0x000000006C580000-0x000000006D8C1000-memory.dmp

Filesize
19.3MB

Download
memory/5704-13618-0x000000006C580000-0x000000006D8C1000-memory.dmp

Filesize
19.3MB

Download
memory/5704-13648-0x000000006D8D0000-0x000000006EC11000-memory.dmp

Filesize
19.3MB

Download
memory/5704-13656-0x000000006C580000-0x000000006D8C1000-memory.dmp

Filesize
19.3MB

Download
memory/5704-13649-0x000000006C580000-0x000000006D8C1000-memory.dmp

Filesize
19.3MB

Download
memory/6100-13394-0x0000011C80760000-0x0000011C8088A000-memory.dmp

Filesize
1.2MB

Download
memory/7036-13622-0x000001F8FCA50000-0x000001F8FCB7A000-memory.dmp

Filesize
1.2MB

Download
memory/8436-13621-0x00000286B2890000-0x00000286B29A5000-memory.dmp

Filesize
1.1MB

Download
memory/10592-13623-0x0000029DDE650000-0x0000029DDE77A000-memory.dmp

Filesize
1.2MB

Download
memory/13976-13415-0x000000006DFB0000-0x000000006F2F1000-memory.dmp

Filesize
19.3MB

Download
memory/13976-13383-0x000000006DFB0000-0x000000006F2F1000-memory.dmp

Filesize
19.3MB

Download
memory/13976-13430-0x000000006DFB0000-0x000000006F2F1000-memory.dmp

Filesize
19.3MB

Download
memory/14140-13388-0x000002416BA40000-0x000002416BB55000-memory.dmp

Filesize
1.1MB

Download
memory/14140-13544-0x000002416BA40000-0x000002416BB55000-memory.dmp

Filesize
1.1MB

Download
memory/14140-13416-0x000002416BA40000-0x000002416BB55000-memory.dmp

Filesize
1.1MB

Download
memory/14188-13389-0x0000023B1E880000-0x0000023B1E995000-memory.dmp

Filesize
1.1MB

Download
memory/14972-13619-0x0000013D5F280000-0x0000013D5F395000-memory.dmp

Filesize
1.1MB

Download
memory/15008-13620-0x00000268F9F10000-0x00000268FA025000-memory.dmp

Filesize
1.1MB

Download